Lapidus is with Kroll — a cyber security and investigations firm — he said there are countless ways thieves can get their hands on this information.

“You see criminals diving into dumpsters to get paper files. You see criminals putting malware on networks and accessing employee files,” he said.

“You will get an unsolicited email asking you to confirm your social security number or enter your debit card in order for the IRS to be able to process your tax return. They are simply trying to steal your information,” IRS spokesperson Anny Pachner explained.

Pachner said scam artists aren’t just going after individual taxpayers.

Zagaros might have been on the hook for the payment, but his phony return was flagged by new filters put in place by the IRS. He also subscribes to ID Shield — a monthly service that protects his identity.

“We can guide the victim through the steps the victim needs to take. We can open up a restoration case. If there are any other issues with their social security number or any other accounts. This gives the victim a sense that they have something on their side,” Ellen Abbot explained.

Zagaros still doesn’t know how his information was breached.

“If you think it’s not going to happen to you, you’re crazy. It can happen to anybody,” he said.

Last tax season the IRS thwarted nearly $6.8 billion in fraudulent tax refunds.